OpenId Connect reauthentication with only a token -
is possible restablish session openid connect authorization server (get cookies set in browser) without passing credentials (for example id token or access token or minimal data doesn't include user credentials) ?
thanks
there's extension of core openid connect specification called openid connect session management (http://openid.net/specs/openid-connect-session-1_0.html) allows type of functionality.
when refreshing session rp send authentication request prompt=none
parameter , id_token_hint
contains current id_token
. openid connect rp may issue new id_token
, return rp in authentication response. see last 2 paragraphs of section http://openid.net/specs/openid-connect-session-1_0.html#rpiframe
Comments
Post a Comment